Multi-Context Broker functionality in Shibboleth v3 - Comments please.

[David Walker]

A little background...

The MCB's limit was intended to be on the number of times the user is
allowed to select an authentication method.  Each authentication method
could also allow multiple tries (and, in fact, I figured that
username/password methods would try multiple times without before
returning to the MCB).  We wanted to handle, for example, the case where
a user selected a method requiring a hardware token and then found she
didn't have the token in her pocket by giving her a chance to choose
another method.  The limit was to keep the user from being trapped and
never returning control to the SP.  (FYI, at some point along the line,
I had a discussion with Scott and decided that the best thing would have
been always to return the user to the SP, figuring that it would then
decide to prompt the user to login again, but we had already released
the MCB by then.)

Now that we've got some experience with the MCB, however, it appears
that 1) many IdP administrators avoid providing choices of
authentication methods, due to the confusion it causes, and 2) IdP
administrators avoid dumping users back to an SP, as the probability is
high that the SP will not treat the user well.

So, I have a couple of questions, one for Scott and one for everyone:

 1. Scott, if the authentication method web flow returns failure, will
    Shib v3 return failure to the SP or give the user another chance?
 2. David Bantz and others, are you looking for 1) multiple attempts to
    select an authentication method (as the MCB does), 2) multiple
    attempts for select authentication methods (/e.g./,
    username/password, but not second factor), 3) multiple attempts for
    all authentication methods, or something else?


David


On 04/20/2015 12:12 PM, Cantor, Scott wrote:
> On 4/20/15, 6:41 PM, "db at alaska.edu" <dabantz at alaska.edu> wrote:
>
>
>> Agreed; that's the scenario I want to avoid.  In MCB / IdP 2 I avoid by 
>> setting high threshold for max failures.  I want a config or other means 
>> to avoid in IdP 3 as well.
> There is no notion of limiting the number of failures at all.
>
> -- Scott
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150421/a6e82c9c/attachment.html>